vault.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Vault.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Vault.dll
Resource
win10v2004-20240426-en
General
-
Target
Vault.dll
-
Size
911KB
-
MD5
669e18322f05a14356e8f6da16d15da0
-
SHA1
d22ce453d1e4e7ebf52e969f253681cd214f6c62
-
SHA256
5c75ec82ad89006a399ec513ca8ac3b161d65703e48b9113f414999bde862b12
-
SHA512
e3bcd26b5468a350bc534f2e79c5aae1ae55e52ce445f4dd49a6684bbac7ad1ab6dd445173948bee311a697b17b2dae3e55e02b7103c7c1e04da3e9f854d7821
-
SSDEEP
12288:Vw7T1jKCXonL+c4gA4JGuNA3m/MGMPZX1D05mASL:VQZOBVA4JGUA3m6c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Vault.dll
Files
-
Vault.dll.dll windows:6 windows x86 arch:x86
b83158409a0216854ad0fe48f6caa846
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
_CxxThrowException
__RTDynamicCast
_itow_s
memset
_vsnwprintf_s
_callnewh
malloc
_XcptFilter
_initterm
_amsg_exit
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memmove_s
_purecall
__CxxFrameHandler3
_vsnwprintf
wcscpy_s
tolower
free
memcpy
kernel32
GetModuleHandleW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetModuleFileNameW
OutputDebugStringA
LocalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
GetCurrentThread
GetDateFormatW
FileTimeToSystemTime
GetSystemTime
CompareStringOrdinal
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
CreateFileW
DeviceIoControl
GetVersionExW
FormatMessageW
GetSystemDirectoryW
CreateProcessW
CloseHandle
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
advapi32
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
CredGetSessionTypes
CredFree
CredWriteW
CredEnumerateW
CredDeleteW
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
CredMarshalCredentialW
TraceEvent
RegCloseKey
CredUnmarshalCredentialW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
shlwapi
ord24
ord514
ord494
ord637
ord618
ord156
ord174
ord219
ord493
ord176
ord172
ord199
ord496
ord158
ord256
ord204
SHStrDupW
shell32
ord25
ord155
ord102
ord165
SHBindToObject
SHParseDisplayName
ord18
ShellExecuteExW
ole32
CoTaskMemFree
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VariantClear
user32
LoadStringW
SetCursor
LoadCursorW
GetFocus
SendMessageW
LoadImageW
DestroyIcon
vaultcli
VaultGetItem
VaultUnRegisterNotification
VaultRegisterNotification
VaultCopyItem
VaultCopyVault
VaultFree
VaultRemoveItem
VaultConfirmVaultAccess
VaultAddItem
VaultGetItemType
VaultEnumerateItems
VaultCloseVault
VaultCreateVault
VaultDeleteVault
VaultGetInformation
VaultOpenVault
VaultLoadVaults
VaultEnumerateVaults
VaultLockVault
VaultUnlockVault
VaultSetInformation
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
crypt32
CertCloseStore
CertGetEnhancedKeyUsage
CertFreeCertificateChainList
CertSelectCertificateChains
CertOpenSystemStoreW
CertFindCertificateInStore
CertGetNameStringW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertAddSerializedElementToStore
cryptui
CertSelectionGetSerializedBlob
credui
CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW
dui70
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetAtom@Value@DirectUI@@QAEGXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?SetSelection@Combobox@DirectUI@@QAEJH@Z
?SelectionChange@Combobox@DirectUI@@SG?AVUID@@XZ
?AddString@Combobox@DirectUI@@QAEHPBG@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
InitProcessPriv
?SetEncodedContentString@Element@DirectUI@@QAEJPBG@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
UnInitProcessPriv
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
??1XProvider@DirectUI@@UAE@XZ
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?SetBorderStyle@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetDataEngine@Repeater@DirectUI@@QAEXPAUIDataEngine@2@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?Register@Combobox@DirectUI@@SGJXZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?OnNotify@Combobox@DirectUI@@UAE_NIIJPAJ@Z
?Initialize@Combobox@DirectUI@@QAEJIPAVElement@2@PAK@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?CreateHWND@Combobox@DirectUI@@UAEPAUHWND__@@PAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnAdjustWindowSize@Combobox@DirectUI@@UAEHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetEncodedContentString@Element@DirectUI@@QAEJPAGI@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
??0XProvider@DirectUI@@QAE@XZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
??1Proxy@DirectUI@@UAE@XZ
??1CritSecLock@DirectUI@@QAE@XZ
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0Proxy@DirectUI@@QAE@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?Invoke@Proxy@DirectUI@@IAEXIPAX@Z
?GetID@Element@DirectUI@@QAEGXZ
??1IDataEngine@DirectUI@@UAE@XZ
??0IDataEngine@DirectUI@@QAE@XZ
UnInitThread
?Release@Value@DirectUI@@QAEXXZ
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
GetElementDataEntry
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
InitThread
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
??1IDataEntry@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
?SetActive@Element@DirectUI@@QAEJH@Z
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetString@Value@DirectUI@@QAEPBGXZ
?GetType@Value@DirectUI@@QBEHXZ
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?SetAbsorbsShortcut@Element@DirectUI@@QAEJ_N@Z
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Combobox@DirectUI@@SGPAUIClassInfo@2@XZ
??1Combobox@DirectUI@@UAE@XZ
??0Combobox@DirectUI@@QAE@XZ
?OnPropertyChanged@Combobox@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@Combobox@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Combobox@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?OnHosted@Combobox@DirectUI@@UAEXPAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
ntdll
EtwTraceMessage
EtwLogTraceEvent
WinSqmAddToStream
WinSqmStartSession
WinSqmEndSession
WinSqmSetDWORD
rpcrt4
UuidToStringW
RpcStringFreeW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 307KB - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 568KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ